A Fast Multicore-based Window Entropy Algorithm

Malware analysis is a major challenge in cybersecurity due to the regular appearance of new malware and its effect in cyberspace. The existing tools for malware analysis enable reverse engineering to understand the origin, purpose, attributes, and potential consequences of malicious software. An entropy method is one of the techniques used to analyze and detect malware, which is defined as a measure of information encoded in a series of values based upon the probability of those values appearing. The window entropy algorithm is one of the methods that can be applied to calculate entropy values in an effective manner. However, it requires a significant amount of time when the size of the file is large. In this paper, we solve this problem in two ways. The first way of improvement is determining the best window size that leads to minimizing the running time of the window entropy algorithm. The second way of improvement is by parallelizing the window entropy algorithm on a multicore system. The experimental studies using artificial data show that the improved sequential algorithm can reduce the window entropy method’s running time by 79% on an average. Also, the proposed parallel algorithm outperforms the modified sequential algorithm by 77% and has super-linear speed up.

@article{Shokr2022,
  title     = {A Fast Multicore-based Window Entropy Algorithm},
  journal   = {International Journal of Advanced Computer Science and Applications},
  volume    = {13},
  number    = {11},
  year      = {2022},
  publisher = {The Science and Information Organization},
  author    = {Suha S.A. Shokr and Hazem M. Bahig},
  doi       = {10.14569/IJACSA.2022.0131127},
  url       = {https://doi.org/10.14569/IJACSA.2022.0131127}
}